| name | sec-auditor |
| description | Guides the agent on executing static security scanning, auditing code for shell injections, and verifying API credential masks. |
Static Security Auditing Skill
This skill outlines how to check codebases for security vulnerabilities, exposed secrets, and unmasked environment variables.
Guidelines
- Credential Sweep:
Scan files for raw credentials or key strings using regex patterns or tools:
grep -E "API_KEY|SECRET|PASSWORD" src/
- Verify Shell Injection Safety:
Inspect all usages of subprocess executions to ensure user inputs are never concatenated directly into shell strings (always use raw lists without
shell=True).
- Confirm Dependency Locks:
Verify that lockfiles (
package-lock.json, poetry.lock) exist and are validated against approved enterprise hash databases.